>> The issue is when somebody doesn't use RLS correctly.

True, but I've seen staff+ level developers get bit by this. What hope do vibe coders have?

You have called out the issue precisely! The problem is that Supabase, and Lovable, market this product to people who are basically guaranteed to not know how to use RLS correctly. And that the defaults set assume that they do. So on one hand, you're saying "This product is for everyone!" Then on the other hand "You should have security expertise to use this app, and it's not our fault if you misconfigure it! Oh, by the way, we gave it to you misconfigured by default to make it easier for you, the end user, who is somehow both a rube and an expert who definitely understands how security works, to use the app, without configuring anything for security".